So I am renting this server because I need to host some MySQL databases. I can ssh into the server but have no physical access to it. It's not currently running a firewall, which is not good security practice. I want to setup a firewall on it, but am afraid of locking myself out.

What is the usual way of setting up a firewall on a remote server without locking yourself out ?

Haven't been here in a while, I know. I've been busy.

EDIT: P.S. This is a production server. I'll be doing this not during working hours, but if something happens that I can't fix overnight, I'm fired...

While you are testing, set up a cron job to clear your iptables rules every 30 mins or so.
What else is running on the server?
Do you want to restrict access to your MySQL by ip?
Otherwise, what do you hope to achieve with your firewall rules?

1 members found this post helpful.

There are at least two ways of setting up a remote firewall without locking yourself out. One is to save the last known working firewall rules and then use an 'at' job to automatically restore them after a few minutes. That gives a short window to test the new rules and limits the possible lockout to the time until the at job. Another method is to use 'iptables-apply'. See the manual pages for either 'at' or 'iptables-apply'

1 members found this post helpful.

Thanks, that makes sense, an at or cron job would do it.

The server is running MySQL and Bittorrent Sync. That's about it. Then I need SSH access.

I did restrict MySQL access by IP only.

What do I want to achieve with the firewall rules. I guess since I'm only running these two services, it won't help much will it. I'm just trying to secure the server.

I have disallowed root login to SSH. I'll disable unused services. Other ideas are welcome.

Here are some thoughts:

1. Secure ssh access with a key instead of passwords.
2. Drop everything that does not need access.
3. Setup the firewall to allow only those that require it.
4. Install Fail2ban and completely block anything that fails the second attempt to login after you got keys setup and functioning properly for ssh.

1 members found this post helpful.

if you afraid of locking yourself out when you're configuring the firewall, i suggest you to use an excellent package named screen.
with screen you can have multiple terminals and your access to the server will be fine even if your connection is disrupted by a firewall rule.

screen or tmux can help you keep your work flow but it won't let you back in if you lock yourself out with the firewall. cron, at, or iptables-apply would be the way to let yourself back in.